CVE-2026-0142 Google CVE debrief

Who should care

Defenders responsible for Android systems should assess exposure and prioritize verifying and applying patches from the vendor, Google. They should also monitor for any potential exploitation attempts and review and update inventory to ensure affected systems are identified and remediated. The vulnerability affects Android systems and has a CVSS score of 4. The NVD vulnerability detail page and vendor advisory provide additional information on the and the

Why it matters

A possible out of bounds read due to improper input validation in iavb_parse_key_data of avb_rsa.c could lead to local information disclosure. Defenders responsible for Android systems should assess exposure and prioritize verifying and applying patches from the vendor, Google.

• Local information disclosure possible due to improper input validation.
• No additional execution privileges needed for exploitation.
• User interaction is not needed for exploitation.
• Defenders should verify and apply patches from the vendor, Google.

Technical summary

A possible out of bounds read due to improper input validation was discovered in iavb_parse_key_data of avb_rsa.c. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. The issue affects Android systems, and defenders should assess exposure and prioritize verifying and applying patches from the vendor, Google. The vulnerability has a CVSS score of 4 and a severity of MEDIUM. The CVE record and NVD vulnerability detail page provide information on the vulnerability.

Defensive priority

Defenders should prioritize verifying and applying patches from the vendor, Google, for the affected product, Android. They should also monitor for any potential exploitation attempts.

Recommended defensive actions

• Verify and apply patches from the vendor, Google, for the affected product, Android.
• Monitor for any potential exploitation attempts.
• Review and update inventory to ensure affected systems are identified and remediated.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD vulnerability detail page provide information on the vulnerability. The vendor advisory from Google is also available. The issue has been publicly disclosed and defenders should verify and apply patches from the vendor, Google. The vulnerability affects Android systems and has a CVSS score of 4. The NVD vulnerability detail page and vendor advisory provide additional information on the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.